topic Re: Extracting field value gets encoded. Why? in Splunk Search

Extracting field value gets encoded. Why?

jkim34 — Mon, 08 Jan 2018 20:18:49 GMT

I have extracted value from the message log. So I have custom field with its value.
In the log, it displays "* myName=J&K *"
The extract field is myName, and it's value is now "J\u0026K".
Even when I export this in PDF or CSV, encoded value gets displayed.

Why is this occurring, and is there way to prevent automatic encoding?

Re: Extracting field value gets encoded. Why?

somesoni2 — Mon, 08 Jan 2018 20:54:13 GMT

How are you extracting the field? Can you share configuration/regex for it?

Re: Extracting field value gets encoded. Why?

jkim34 — Tue, 09 Jan 2018 12:56:24 GMT

Hi, regex is something like below:

(?<=myName=){1}(?P<myName>.+)(?=, nextKeyWord)

Where it looks for the preceding regex just before the value that I'm extracting for, and until it sees , nextKeyWord

Re: Extracting field value gets encoded. Why?

p_gurav — Tue, 29 Sep 2020 17:36:16 GMT

Hi jkim34,

Could you try this regex "myName=(?P[^,\s*(next*)]+)"

Re: Extracting field value gets encoded. Why?

jkim34 — Wed, 10 Jan 2018 12:50:24 GMT

Hi p_gurav,
This don't seem to work. Also other field-value do contain white spaces, commas, etc.
This issue so far seems to be an issue with character & < >
At this point, I'm wondering if this is OOTB issue, or something that needs to be done inside configuration file..

Re: Extracting field value gets encoded. Why?

p_gurav — Wed, 10 Jan 2018 12:56:58 GMT

My bad, Try this:

myName=(?P<myname>[^,\s*(next*)]+)

Re: Extracting field value gets encoded. Why?

jkim34 — Wed, 10 Jan 2018 13:15:43 GMT

Sorry, I've actually tried this with bracket <>

Re: Extracting field value gets encoded. Why?

p_gurav — Wed, 10 Jan 2018 13:40:06 GMT

Could you please tell me exact search command you are running and one whole sample event?

Re: Extracting field value gets encoded. Why?

jkim34 — Wed, 10 Jan 2018 15:29:20 GMT

Besides regex I stated above, I have following additional information:
Log Message=Form [myAddress=1 Main St., myName=J&K, myPhoneNumber=111-111-1111]
Search Command=search term | table myName

Re: Extracting field value gets encoded. Why?

ddrillic — Wed, 10 Jan 2018 21:39:35 GMT

-- This issue so far seems to be an issue with character & < >
Why does it feel like your data is being treated like XML data? ; - )

Re: Extracting field value gets encoded. Why?

jkim34 — Thu, 11 Jan 2018 18:24:09 GMT

You are right. Maybe I should revise my question a bit 🙂